tifiucem said:
Tifiucem's sops budget: $0.
Lmao ok you got me im going to try it this weekend. 40 boxes though. Do I need 40 age keys or one? Please say one
What do you use for secrets management across multiple cheap boxes?
cpanelliw780 said:
Do I need 40 age keys or one?
One key can encrypt for many recipients. Or you make one key per box if you want blast radius small. I do per-project keys, not per-box. 8 boxes, 3 keys. My blog key, my monitoring key, my scraper key.
çok ucuz, çok hızlı
HostHatch Singapore VM here. I tried sops but the age binary is not in debian repos. Had to download from GitHub release. Not hard but felt dirty. Now it works. My .env has DATABASE_URL and MAILGUN_KEY, both encrypted in git.
I also rotate keys every 6 months by making new age key and re-encrypting. Is this overkill?
Every 6 months is fine if automated. I rotate yearly because Melbourne latency to everywhere means my ansible runs slow and I hate waiting.
Speaking of which: does anyone run sops with ansible pull? Or all git-based here?
100% packet loss at hop 3
sander_ams
Member
pam3 said:
Ansible pull
I tried ansible for this. It works but felt heavy. Git + sops + cron is lighter for small shop. If I had 100 boxes maybe ansible. With 12? Git is enough.
My script is 12 lines. Ansible was 40 lines and a inventory file and a vault password and I forgot the vault password twice.
pauloserver
Member OP
sander_ams said:
I forgot the vault password twice
Kkkkkk this is why I am afraid of all of you. You are me. I will lose the key. I will forget the password. But I am going to try anyway. HostHatch does not offer managed anything so it is on me.
One more thing: do you encrypt the whole compose file or just .env? I have some services where the compose has secrets in environment blocks too.
chill infrastructure for chill people 🦫
pauloserver said:
Encrypt the whole compose file or just .env
Just .env enough lor. Or use sops docker compose plugin if you fancy. But simple way: encrypt .env, compose read from .env. Docker compose support env_file one. No need put secret in compose itself.
This thread convinced me. I was doing the same scp hell on Racknerd and VirMach. Setting up sops tonight. Thanks pauloserver for admitting the shame so the rest of us could learn.
pauloserver said:
HostHatch VMs
I have six on HostHatch too. Stockholm and London. Good price but their control panel is from 2014. Anyway I use sops with AGE-PLUGIN-YUBIKEY so the private key never touches disk. Highly recommend if you have Yubikey 5.
pauloserver
Member OP
jordguru said:
AGE-PLUGIN-YUBIKEY
Did not know this exists. Adding to list. My shopping list now: Yubikey, courage, weekend.
Valeu gente. I will report back if I burn everything down.
chill infrastructure for chill people 🦫